Cut per-frame work in the explore screen, and harden the git probe, link guard and file-table reader

[armada45-pixel]

Three commits, each reviewable on its own. None of this overlaps #80, #81 or #82 as far as I can tell; where it came close (a mark on a name that is not Unicode) I left it to #82.

Performance

• Switching Size / Files re-ranks the tree in place (Arc::make_mut) instead of deep-cloning it first. On a whole disk that clone is tens of millions of nodes.
• Each frame builds label strings only for the 150 labels it will draw: slots are collected by reference, sorted by area, truncated, and only then formatted. The set of marked crumbs is cached until the marks or the tree change (Marks gets a generation counter).
• The sibling menu ranks (index, value) pairs and names only the 24 rows it shows.
• Layout picks the kept children with select_nth_unstable_by and sorts only those, instead of sorting every child of a directory with 100k entries to keep 96.
• The free-space ticker calls space_info on the background executor. A network or sleeping drive can take seconds, and that was the UI thread.

Fixes

• Node::find takes from the front of a VecDeque. Popping the back of a Vec searched depth-first, so a deep match in a late branch could be found before a shallow one.
• Shift-scroll panning is clamped, like every other way of moving the view; it could push the mosaic off screen.
• Byte totals use saturating_add. The release profile has overflow-checks = true, so a wrapped sum was a panic.

Hardening

• git probe: GIT_ALLOW_PROTOCOL=none. With GIT_NO_LAZY_FETCH already set this is a second lock on the same door: a scanned checkout's config must not be able to name a transport for git to run. The Unix test with an ext:: promisor remote passes on git ≥ 2.44 with or without this line (lazy fetch is already off there); it is a regression guard, not a proof.
• removal::linked: when a path's real location cannot be read but its parent is still there, the path is refused instead of passed. Before, a failed canonicalize was treated as "nothing to compare", which fails open.
• mft.rs: bounds for a crafted volume — attribute-list records are capped, a table whose runs are shorter than it claims is refused, and a directory cycle stops the walk so the scan falls back to the ordinary one.
• release.yml: actions pinned to SHAs, persist-credentials: false, and the macOS signing secrets moved from job-level env to the two steps that use them. Not exercised: I cannot run the release workflow, so this one needs a careful look, or drop the commit.

Testing

Windows 11, Rust 1.97.1: cargo xtask lint green, cargo xtask test green (68 app, 157 core, 1 ignored). Not run on Linux or macOS; the new git test is #[cfg(unix)] and so has only been compiled out here — CI will be its first run.

🤖 Generated with Claude Code